EUVD-2025-17742CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H
Lifecycle Timeline
3Tags
Description
Improper access control in Microsoft Local Security Authority Server (lsasrv) allows an unauthorized attacker to deny service over a network.
Analysis
Network-accessible denial-of-service vulnerability in Microsoft's Local Security Authority Server (lsasrv) caused by improper access control (CWE-284). An unauthenticated remote attacker can exploit this with low complexity to render the LSA service unavailable, affecting authentication and security policy enforcement on affected Windows systems. The CVSS 7.5 severity reflects the high availability impact; however, real-world risk depends on EPSS score, KEV candidacy status, and active exploitation data not provided in the source materials.
Technical Context
The Local Security Authority Server (lsasrv) is a critical Windows system service responsible for user authentication, password changes, and security policy enforcement. It operates as a privileged system process and manages sensitive security tokens and credentials. CWE-284 (Improper Access Control) indicates the vulnerability stems from insufficient authorization checks—specifically, the service likely fails to properly validate incoming network requests, allowing an unauthenticated remote attacker to trigger resource exhaustion, infinite loops, or crash conditions via malformed or repeated requests. The service's network accessibility (AV:N) combined with lack of privilege requirements (PR:N) and no user interaction (UI:N) means any remote network actor can trigger this without authentication, making it a direct threat to Windows domain infrastructure and standalone systems.
Affected Products
Microsoft Windows systems running vulnerable versions of lsasrv (Local Security Authority Server). Specific CPE identifiers and version ranges are not provided in the source materials; typical affected products include: Windows Server 2019, Windows Server 2022, Windows 10, and Windows 11 (version-dependent). Enterprise environments relying on Active Directory are at heightened risk. Vendor advisory details and specific patch versions should be obtained from Microsoft Security Updates (portal.msrc.microsoft.com) or the official CVE record at nvd.nist.gov/vuln/detail/CVE-2025-33056.
Remediation
1. Apply Microsoft security patches for CVE-2025-33056 immediately upon availability (check Microsoft Update, Windows Update, or WSUS). 2. Prioritize patching domain controllers and authentication servers first. 3. Interim mitigations (if patch unavailable): restrict network access to LSA-related ports/services via firewall rules; implement network segmentation to limit which systems can reach LSA services; disable remote access to LSA if operationally feasible. 4. Monitor system event logs (Windows Security event ID 4719, 4625, and service-related errors) for exploitation attempts or LSA service crashes. 5. Consult Microsoft Security Response Center (MSRC) advisories for version-specific guidance. Patch availability and KB article numbers should be verified at Microsoft's official security updates page.
Priority Score
Share
External POC / Exploit Code
Leaving vuln.today